Industrial control data flow detection model construction and industrial control data flow detection method and device

Abstract

The application provides an industrial control data flow detection model construction method and device and an industrial control data flow detection method and device, wherein the industrial control data flow detection model construction method comprises the following steps: obtaining an industrial control data flow sample set, the industrial control data flow sample set comprising normal industrial control data flow samples and abnormal industrial control data flow samples; converting each industrial control data flow sample in the industrial control data flow sample set into a binary sequence; dividing the binary sequence according to a preset byte size and taking each byte data after the division as a pixel point to construct a corresponding gray-scale image; and training a preset deep learning model by using each gray-scale image obtained by the construction until a training result meets a preset condition, so as to obtain an industrial control data flow detection model. The embodiment of the application is used to solve the technical problem that unknown threats cannot be detected in the detection of abnormal industrial control data flow in the prior art, and the probability of false detection and missed detection is high.

Description

Technical Field

[0001] This invention relates to the field of industrial control system security technology, and in particular to an industrial control data flow detection model construction and an industrial control data flow detection method and apparatus. Background Technology

[0002] With the deepening integration of industrialization and informatization, industrial control systems face increasingly severe threats. The large-scale connection of industrial control networks to the internet provides traditional cyberattacks with more opportunities to target these networks, potentially causing serious consequences.

[0003] Currently, most abnormal industrial control data stream detection methods target specific content, matching abnormal bytes within the data stream. These methods are unable to detect unknown threats, resulting in a high probability of false positives and false negatives. Therefore, traditional methods for detecting abnormal industrial control data streams often fall short of ideal results. Summary of the Invention

[0004] This application provides a model for constructing an industrial control data flow detection model and a method and apparatus for detecting industrial control data flow, in order to solve the technical problem in the prior art that unknown threats cannot be detected in the detection of abnormal industrial control data flows, and the probability of false detection and missed detection is relatively high.

[0005] The first aspect of this invention provides a method for constructing an industrial control data flow detection model, comprising: acquiring an industrial control data flow sample set, the industrial control data flow sample set including: normal industrial control data flow samples and abnormal industrial control data flow samples; converting each industrial control data flow sample in the industrial control data flow sample set into a binary sequence; dividing the binary sequence according to a preset byte size and constructing a corresponding grayscale image by treating each byte of data after division as a pixel; and training a preset deep learning model using each constructed grayscale image until the training result meets preset conditions, thereby obtaining an industrial control data flow detection model.

[0006] The industrial control data stream detection model construction method provided in this invention does not require matching abnormal bytes in the industrial control data stream. Instead, it converts the industrial control data stream into an image and utilizes the high performance, high recognition rate, and high accuracy of image recognition to detect abnormal industrial control data streams. This solves the problem of inconsistent input formats when training industrial control data streams using neural networks, achieving a concise and easy-to-process input training data. It also addresses the difficulty of matching each abnormal data byte individually in current industrial control flow detection methods. Furthermore, by setting up neural network training and employing deep learning technology, the industrial control data stream detection model is constructed using a feature self-learning approach. This results in a detection model that can quickly learn unknown features in both normal and abnormal industrial control data streams. It can learn the characteristics of new abnormal industrial control data streams and detect both known and unknown industrial control data streams. This solves the detection lag caused by missing abnormal byte matching in detecting unknown abnormal industrial control data streams, achieving a pre-detection effect for unknown abnormal industrial control data streams. This also solves the technical problems of false detection and missed detection in traditional detection methods.

[0007] Optionally, converting each industrial control data stream sample in the industrial control data stream sample set into a binary sequence and dividing the binary sequence according to the byte size and constructing the corresponding grayscale image by treating each byte of data as a pixel includes: converting each data packet of a preset format in each industrial control data stream into a binary sequence; dividing the binary sequence according to the byte size and constructing the corresponding grayscale image by treating each byte of data as a pixel.

[0008] Optionally, before the step of converting each industrial control data stream sample in the industrial control data stream sample set into a binary sequence, the method further includes:

[0009] The data packets in the industrial control data stream of the obtained industrial control data stream sample set are filtered and preprocessed.

[0010] Optionally, before dividing the binary sequence according to byte size, the method includes: normalizing the length of the converted binary sequence.

[0011] Optionally, the length of the binary byte sequence is normalized, including: obtaining the length of the bytes contained in the binary sequence; if the length of the bytes in the binary sequence is less than a preset length, padding the insufficient part with zeros; if the length of the bytes in the binary sequence is greater than the preset length, truncating the binary sequence of the preset length from the corresponding binary sequence.

[0012] Optionally, each byte of data after division is treated as a pixel to construct the corresponding grayscale image. The method includes: determining the size of the grayscale image to be constructed based on the byte length contained in the normalized binary sequence; determining the grayscale value of each pixel in the grayscale image to be constructed according to the decimal size corresponding to each byte of data after division; and arranging the grayscale values ​​of each pixel in a preset order to construct the grayscale image.

[0013] A second aspect of the present invention provides a method for detecting industrial control data streams, comprising:

[0014] Obtain a grayscale image converted from the industrial control data stream to be detected; input the grayscale image into a target detection model constructed using the industrial control data stream detection model construction method in the first aspect or any optional scheme of the first aspect; determine whether the industrial control data stream to be detected is abnormal based on the output result of the target detection model.

[0015] A third aspect of the present invention provides an industrial control data flow detection model construction device, comprising: a first acquisition module for acquiring an industrial control data flow sample set, the industrial control data flow sample set including: normal industrial control data flow samples and abnormal industrial control data flow samples; a conversion module for converting each industrial control data flow sample in the industrial control data flow sample set into a binary sequence; a construction module for dividing the binary sequence according to a preset byte size and constructing a corresponding grayscale image by treating each byte of data after division as a pixel; and a training module for training a preset deep learning model using each constructed grayscale image until the training result meets preset conditions, thereby obtaining an industrial control data flow detection model.

[0016] The functions performed by each component in the industrial control data flow detection model construction device provided by the present invention have been applied in any of the method embodiments of the first aspect above, and therefore will not be repeated here.

[0017] The fourth aspect of the present invention provides an industrial control data stream detection device, comprising: a second acquisition module for acquiring a grayscale image converted from the industrial control data stream to be detected; an input module for inputting the grayscale image into a target detection model constructed using the industrial control data stream detection model construction method of the first aspect or any optional scheme of the first aspect; and a determination module for determining whether the industrial control data stream to be detected is abnormal based on the output result of the target detection model.

[0018] The fifth aspect of the present invention provides a computer device, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; the memory is used to store computer programs; and the processor is used to implement the steps of the industrial control data flow detection model construction method of the first aspect or the steps of the industrial control data flow detection method of the second aspect when executing the program stored in the memory.

[0019] The sixth aspect of the present invention provides a computer-readable storage medium storing computer instructions for causing a computer to execute the industrial control data flow detection model construction method provided in the first aspect of the present invention, or to execute the industrial control data flow detection method provided in the second aspect of the present invention. Attached Figure Description

[0020] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0021] Figure 1 This is a flowchart illustrating an industrial control data stream detection method according to an embodiment of the present invention.

[0022] Figure 2 This is a flowchart illustrating a method for constructing an industrial control data flow detection model according to an embodiment of the present invention.

[0023] Figure 3 This is a flowchart illustrating a method for constructing an industrial control data flow detection model according to an embodiment of the present invention.

[0024] Figure 4 This is a flowchart illustrating a method for constructing an industrial control data flow detection model according to an embodiment of the present invention.

[0025] Figure 5 This is a flowchart illustrating a method for constructing an industrial control data flow detection model according to an embodiment of the present invention.

[0026] Figure 6 This is a flowchart illustrating a method for constructing an industrial control data flow detection model according to an embodiment of the present invention.

[0027] Figure 7 This is a flowchart illustrating an industrial control data stream detection method according to an embodiment of the present invention.

[0028] Figure 8Schematic structural diagram of a device for constructing an industrial control data stream detection model provided by an embodiment of the present invention;

[0029] Figure 9 Schematic structural diagram of an industrial control data stream detection device provided by an embodiment of the present invention;

[0030] Figure 10 Schematic structural diagram of a computer device provided by an embodiment of the present invention. Detailed implementation manners

[0031] To make the objectives, technical solutions and advantages of the embodiments of the present disclosure clearer, the technical solutions of the embodiments of the present disclosure will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present disclosure. Apparently, the described embodiments are some, but not all, of the embodiments of the present disclosure. All other embodiments obtained by those of ordinary skill in the art based on the described embodiments of the present disclosure without creative efforts shall fall within the scope of protection of the present disclosure.

[0032] Unless otherwise defined, the technical terms or scientific terms used in the present disclosure shall have the ordinary meanings understood by those of ordinary skill in the art to which the present disclosure pertains. The use of "a", "one" or "the" and similar words in the present disclosure does not also represent a limitation in quantity, but means that there is at least one. Words such as "including" or "comprising" and the like mean that the elements or objects appearing before this word cover the elements or objects listed after this word and their equivalents, without excluding other elements or objects.

[0033] In addition, the technical features involved in different embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0034] As mentioned in the background art, the current methods for detecting abnormal industrial control data streams, such as Figure 1 shown, detect specific content and match abnormal bytes in the industrial control data stream. They cannot detect unknown threats, are difficult to detect, consume a lot of resources, and have a relatively high probability of false detection and missed detection. At the same time, when facing the large-scale access of industrial control networks to the Internet, traditional network attacks will have more opportunities to attack industrial networks, resulting in very serious consequences. Considering the characteristics that the data content transmitted in industrial networks has a specific form, such as being very different from ordinary networks in terms of time arrangement, transmission control actions, linkage actions, etc., the traditional methods for detecting abnormal industrial control data streams cannot achieve good results. And due to control reasons in industrial control networks, it is not easy to detect abnormal situations in data streams transmitting specific control actions within the network.

[0035] To address the technical problems mentioned in the background art, an embodiment of the present invention provides a method for constructing an industrial control data stream detection model, as Figure 2As shown, the steps of this method include:

[0036] Step S110: Obtain the industrial control data flow sample set, which includes: normal industrial control data flow samples and abnormal industrial control data flow samples.

[0037] For example, a large number of normal and abnormal industrial control data streams are collected from the industrial control data stream to form an industrial control data stream sample set.

[0038] Step S120: Convert each industrial control data stream sample in the industrial control data stream sample set into a binary sequence.

[0039] For example, the data stored in the acquired industrial control data stream sample is represented in a format that the industrial control equipment can interpret and process, and is not suitable for direct image conversion. Therefore, these data streams need to be converted into binary sequences for subsequent operations.

[0040] The technology for converting data streams of different formats into binary sequences is relatively mature, and in practical applications, the appropriate method can be selected according to specific needs, which will not be elaborated here.

[0041] Step S130: Divide the binary sequence according to a preset byte size and construct the corresponding grayscale image by treating each byte of data as a pixel.

[0042] For example, a binary sequence is divided into bytes, and each byte value can be mapped to a value in the range [0, 255]. If 0 represents black and 255 represents white, values ​​in the range [0, 255] can represent different grayscale values. Each byte in the binary sequence corresponds to a pixel, and each byte value corresponds to a grayscale value, thus visualizing the binary sequence to generate a grayscale image.

[0043] Step S140: Use each grayscale image obtained to train the preset deep learning model until the training result meets the preset conditions to obtain the industrial control data flow detection model.

[0044] For example, deep learning models can be constructed using different architectures according to actual needs. As an optional implementation, in this embodiment, the industrial control data flow detection model uses the Caffe framework to build a deep learning model, selects the Fast-CNN deep learning algorithm, and trains the model using the grayscale image obtained in step S130.

[0045] Specifically, such as Figure 3As shown, the deep learning model built on the Caffe framework consists of five layers. From left to right, they are the input layer, the first convolutional layer (C1), the first pooling layer (P2), the second convolutional layer (C3), the second pooling layer (P4), the fully connected layer (F5), and the output layer (F5'). The first convolutional layer (C1) uses 64 6x6 convolutional kernels to perform convolution operations on the converted grayscale image. After convolutional feature completion, the feature map size is 64x64, and the number of output feature maps is 128. The first pooling layer (P2) uses 4x4 pooling, resulting in a 16x16 output feature map size and 128 output feature maps. Furthermore, the second convolutional layer (C3) uses 64 6x6 convolutional kernels to perform convolution operations on the converted image. After convolutional feature completion, the feature map size is 16x16, and the number of output feature maps is 256. The second pooling layer (P4) uses a 2x2 pooling operation, outputting 128 8x8 feature maps. The number of neurons is 128*6*6 = 4068, and the number of output feature maps is 256. The fully connected layer (F5) uses a 6x6 convolutional kernel to convolve around layer P4, while simultaneously handling the loss of features with lower weights. The features are then fully connected, and finally, the output layer (F5') outputs two feature maps.

[0046] The industrial control data stream detection model construction method provided in this invention does not require matching abnormal bytes in the industrial control data stream. Instead, it converts the industrial control data stream into an image and utilizes the high performance, high recognition rate, and high accuracy of image recognition to detect abnormal industrial control data streams. This solves the problem of inconsistent input formats when training industrial control data streams using neural networks, achieving a concise and easy-to-process input training data. It also addresses the difficulty of matching each abnormal data byte individually in current industrial control flow detection methods. Furthermore, by setting up neural network training and employing deep learning technology, the industrial control data stream detection model is constructed using a feature self-learning approach. This results in a detection model that can quickly learn unknown features in both normal and abnormal industrial control data streams. It can learn the characteristics of new abnormal industrial control data streams and detect both known and unknown industrial control data streams. This solves the detection lag caused by missing abnormal byte matching in detecting unknown abnormal industrial control data streams, achieving a pre-detection effect for unknown abnormal industrial control data streams. This also solves the technical problems of false detection and missed detection in traditional detection methods.

[0047] As an optional embodiment of the present invention, steps S120 and S130 include:

[0048] Step S210: Convert each data packet of a preset format in each industrial control data stream into a binary sequence.

[0049] For example, since the data is collected in a data stream manner, it needs to be processed by separating the data stream into packets. For example, in this embodiment, the data packets in the data stream are converted into binary sequences for processing.

[0050] The purpose of using a preset data packet format in this embodiment is that, in practical applications, data packets are stored in a preset format as needed to facilitate manipulation. For example, if a certain software or program is adept at processing data in a certain format, the data packet needs to be converted to the specified format for processing by the corresponding software or program. Specifically, in this embodiment, for ease of operation, the acquired data stream is stored in pcap format, and then the pcap format data packet is converted into a binary file, such as... Figure 4 As shown in the diagram, "bin" represents the binary file format. There are no restrictions on the data packet storage format here; the appropriate format should be selected based on the specific application requirements.

[0051] Step S220: Divide the binary sequence according to the byte size and construct a grayscale image corresponding to each data packet by treating each byte of data as a pixel.

[0052] In this embodiment, step S220 is similar to step S130 in the above embodiment, and will not be described again here.

[0053] The industrial control data flow detection model construction method provided in this embodiment of the invention facilitates software or program operations on the data by storing data packets in a specified format, thereby improving data processing efficiency.

[0054] As an optional embodiment of the present invention, it further includes:

[0055] Step S310: Perform filtering and preprocessing on the data packets in the industrial control data stream of the obtained industrial control data stream sample set.

[0056] For example, the acquired industrial control data stream may contain different types of data packets, such as data packets sent from the same source IP to different destination IPs, outgoing data packets, and feedback data packets. These data packets may not all be needed for training the model, or some of the acquired data packets may have defects. Therefore, it is necessary to preprocess and filter the data packets in the acquired industrial control data stream. Specifically, before filtering, the data packets need to be classified, such as... Figure 4As shown, since the data is collected in a data stream manner, it needs to be separated into packets. In this embodiment, the data stream is separated into different data packet formats according to the five-tuple (source port number, destination port number, protocol, source IP, destination IP), start sending time, and packet length. To enhance the diversity of data samples and improve their quality, the sample data packets in this embodiment include data packets obtained by reversing the source and destination IP and source and destination ports.

[0057] The data packets in the data stream are classified according to the above classification rules. From these classified packets, the necessary data packets for training the model are selected. For example, if the data packets required for training the model need to meet certain parameters of the five-tuple, these parameters can be set as filtering conditions to filter the data packets. There are no restrictions on the setting of the data filtering conditions here; they can be adjusted adaptively according to actual needs. At the same time, the acquired data packets may also contain duplicate or incomplete data packets, which also need to be filtered and cleaned up. Figure 4 As shown. Furthermore, since the data packets contain MAC and IP addresses, but MAC and IP addresses rarely exhibit the attack characteristics found in industrial data streams, using MAC and IP addresses as training features for the detection model would result in the training data generating more features, affecting model training. Therefore, the MAC and IP addresses in the classified data packets are randomized to reduce the number of training features.

[0058] The industrial control data flow detection model construction method provided in this embodiment of the invention accurately filters effective data by preprocessing the data, thereby obtaining high-quality data that meets the standards of accuracy, completeness, and conciseness, ensuring that the data package can better serve the construction of the detection model.

[0059] As an optional embodiment of the present invention, it further includes:

[0060] Step S410: Normalize the length of the converted binary sequence.

[0061] For example, because the binary sequences converted from different data packets have different lengths, the resulting grayscale images have different two-dimensional dimensions, leading to inconsistent evaluation metrics. In the field of machine learning, different evaluation metrics often have different dimensions and units, which can affect the results of data analysis. To eliminate the influence of dimensions between metrics, data normalization is required to ensure comparability between data metrics. After data normalization, the original data is on the same order of magnitude, making it suitable for comprehensive comparison and evaluation. Furthermore, normalizing binary sequences of different lengths before converting them into grayscale images for input into the detection model makes them easier to recognize, thus improving the detection accuracy. The specific normalization process is detailed in steps S510 to S530.

[0062] The industrial control data flow detection model construction method provided in this invention performs data normalization processing on binary sequences to eliminate the influence of dimensions between evaluation indicators, thereby solving the comparability problem between data indicators. After data normalization processing, the original data is all within the same order of magnitude, which is suitable for comprehensive comparative evaluation and improves the classification accuracy of the classification model.

[0063] As an optional embodiment of the present invention, step S410 includes:

[0064] Step S510: Obtain the length of bytes contained in the binary sequence.

[0065] For example, when normalizing a binary sequence, it is first necessary to determine the length standard for normalization, i.e., the preset length. Using this preset length as a reference, the length of the bytes contained in the obtained binary sequence is truncated and padded to make it finally meet the preset length required for normalization.

[0066] Step S520: If the length of bytes in the binary sequence is less than the preset length, the insufficient part is padded with zeros.

[0067] For example, such as Figure 5 As shown, taking a preset length of 1024 bytes as an example, since the sample data in the training dataset needs to have the same length, data packets that are less than 1024 bytes are padded with 0x00.

[0068] Step S530: If the length of the bytes in the binary sequence is greater than the preset length, extract a binary sequence of the preset length from the corresponding binary sequence.

[0069] For example, such as Figure 5As shown, taking a preset length of 1024 bytes as an example, if the length of the binary sequence converted from the data packet is greater than 1024 bytes, then 1024 bytes are taken from the original sequence to form a new binary sequence. It should be noted that if the length of the binary sequence converted from the data packet is greater than the preset length, during truncation, the preset length of bytes can be truncated at the beginning of the binary sequence, or the preset length can be truncated in the middle of the binary sequence. Adjustments can be made according to the actual situation; no restrictions are placed here.

[0070] The industrial control data flow detection model construction method provided in this invention performs data normalization processing on binary sequences to eliminate the influence of dimensions between evaluation indicators, thereby solving the comparability problem between data indicators. After data normalization processing, the original data is all within the same order of magnitude, which is suitable for comprehensive comparative evaluation and improves the classification accuracy of the classification model.

[0071] As an optional embodiment of the present invention, it further includes:

[0072] Step S610: Determine the size of the grayscale image to be constructed based on the byte length contained in the normalized binary sequence.

[0073] For example, the size of the grayscale image corresponds to the length of bytes contained in the normalized binary sequence. Specifically, if the normalized binary sequence contains 1024 bytes, then one image size can be determined as 32*32, or other sizes, as long as the product of the two dimensions of the grayscale image is 1024.

[0074] Step S620: Determine the grayscale value of each pixel in the grayscale image to be constructed based on the decimal size corresponding to each byte of data after division.

[0075] For example, a binary sequence can be divided into bytes, and each byte value can be mapped to a value in the range [0, 255]. If 0 represents black and 255 represents white, the values ​​in the range [0, 255] can represent different grayscale values.

[0076] Step S630: Arrange the gray values ​​of each pixel in a preset order to construct a grayscale image.

[0077] For example, each byte in the binary sequence corresponds to a pixel, and each byte value corresponds to a grayscale value. Each byte of the binary file is sequentially converted into a 2D array of [width, height], and finally the 2D array is visualized as a grayscale image in the range of [0, 255].

[0078] For example, as an optional implementation, in practical applications, to facilitate manipulation of grayscale images, this embodiment can encapsulate the grayscale image into an idx format file, and then input it into the detection model for training or detection, such as... Figure 6 There are no restrictions on the data packet storage format here; an appropriate format can be selected based on the actual application requirements.

[0079] The industrial control data flow detection model construction method provided in this embodiment of the invention determines the size of the grayscale image to be constructed by normalizing binary sequences of different lengths, and then converts the normalized binary sequences into grayscale images of uniform size to enter the detection model. This eliminates the dimensional influence between evaluation indicators, solves the comparability between data indicators, makes the detection model easier to identify, and improves the detection accuracy of the detection model.

[0080] This invention provides a method for detecting industrial control data streams, such as... Figure 7 As shown, the method includes the following steps:

[0081] Step S710: Obtain the grayscale image converted from the industrial control data stream to be detected;

[0082] Step S720: Input the grayscale image into the target detection model constructed using any of the above-described industrial control data flow detection model construction method embodiments;

[0083] Step S730: Determine whether the industrial control data stream to be detected is abnormal based on the output results of the target detection model.

[0084] For a detailed explanation of the implementation process of this embodiment, please refer to the above embodiment of the industrial control data flow detection model construction method, which will not be repeated here.

[0085] Figure 8 An industrial control data flow detection model construction device is provided in one embodiment of the present invention. The industrial control data flow detection model construction device in this embodiment includes:

[0086] The first acquisition module 810 is used to acquire an industrial control data stream sample set, which includes normal industrial control data stream samples and abnormal industrial control data stream samples. For details, please refer to the description of step S110 in the above embodiments, which will not be repeated here.

[0087] The conversion module 820 is used to convert each industrial control data stream sample in the industrial control data stream sample set into a binary sequence. For details, please refer to the description of step S120 in the above embodiment, which will not be repeated here.

[0088] The construction module 830 is used to divide the binary sequence according to a preset byte size and construct the corresponding grayscale image by treating each byte of data as a pixel. For details, please refer to the description of step S130 in the above embodiment, which will not be repeated here.

[0089] The training module 840 is used to train a preset deep learning model using each constructed grayscale image until the training result meets preset conditions, thereby obtaining an industrial control data flow detection model. For details, please refer to the description of step S140 in the above embodiment, which will not be repeated here.

[0090] As an optional device in this embodiment, the conversion module 820 includes:

[0091] The conversion submodule is used to convert each preset format data packet in each industrial control data stream into a binary sequence. For details, please refer to the description of step S210 in the above embodiments, which will not be repeated here.

[0092] As an optional device in this embodiment, the construction module 830 includes:

[0093] The first construction submodule is used to divide the binary sequence according to the byte size and construct the grayscale image corresponding to each data packet by treating each byte of data as a pixel. For details, please refer to the description of step S220 in the above embodiment, which will not be repeated here.

[0094] As an optional device in this embodiment, it also includes:

[0095] The filtering module is used to preprocess and filter data packets in the industrial control data streams within the acquired industrial control data stream sample set. For details, please refer to the description of step S310 in the above embodiment, which will not be repeated here.

[0096] As an optional device in this embodiment, it also includes:

[0097] The normalization module is used to normalize the length of the converted binary sequence. For details, please refer to the description of step S410 in the above embodiment, which will not be repeated here.

[0098] As an optional device in this embodiment, the normalization module includes:

[0099] The acquisition submodule is used to obtain the length of bytes contained in the binary sequence. For details, please refer to the description of step S510 in the above embodiment, which will not be repeated here.

[0100] The padding submodule is used to pad the binary sequence with zeros if the length of a byte is less than a preset length. For details, please refer to the description of step S520 in the above embodiment, which will not be repeated here.

[0101] The truncation submodule is used to truncate a binary sequence of a preset length from the corresponding binary sequence if the byte length in the binary sequence is greater than a preset length. For details, please refer to the description of step S530 in the above embodiments, which will not be repeated here.

[0102] As an optional device in this embodiment, the construction module 830 includes:

[0103] The first determining submodule is used to determine the size of the grayscale image to be constructed based on the byte length contained in the normalized binary sequence. For details, please refer to the description of step S610 in the above embodiments, which will not be repeated here.

[0104] The second determining submodule is used to determine the grayscale value of each pixel in the grayscale image to be constructed based on the decimal value corresponding to each byte of data after division. For details, please refer to the description of step S620 in the above embodiment, which will not be repeated here.

[0105] The second construction submodule is used to arrange the grayscale values ​​of each pixel in a preset order to construct a grayscale image. For details, please refer to the description of step S630 in the above embodiment, which will not be repeated here.

[0106] Figure 9 An industrial control data stream detection device is provided according to an embodiment of the present invention. The industrial control data stream detection device in this embodiment includes:

[0107] The second acquisition module 910 is used to acquire the grayscale image converted from the industrial control data stream to be detected. For details, please refer to the description of step S710 in the above embodiment, which will not be repeated here.

[0108] The input module 920 is used to input grayscale images into the target detection model constructed using any of the above-described industrial control data flow detection model construction methods. For details, please refer to the description of step S720 in the above embodiments, which will not be repeated here.

[0109] The determination module 930 is used to determine whether the industrial control data stream to be detected is abnormal based on the output results of the target detection model. For details, please refer to the description of step S730 in the above embodiment, which will not be repeated here.

[0110] This invention provides a computer device, such as... Figure 10 As shown, the device includes one or more processors 1010 and a memory 1020, the memory 1020 including persistent memory, volatile memory, and a hard disk. Figure 10 Taking a processor 1010 as an example, the device may also include an input device 1030 and an output device 1040.

[0111] The processor 1010, memory 1020, input device 1030, and output device 1040 can be connected via a bus or other means. Figure 10 Taking the example of a connection between China and Israel via a bus.

[0112] Processor 1010 may be a Central Processing Unit (CPU). Processor 1010 may also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or combinations thereof. The general-purpose processor may be a microprocessor or any conventional processor. Memory 1020 may include a program storage area and a data storage area. The program storage area may store the operating system and at least one application program required for a function; the data storage area may store data created based on the industrial control data flow detection model construction device or the use of the industrial control data flow detection device. Furthermore, memory 1020 may include high-speed random access memory and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, the memory 1020 may optionally include memory remotely located relative to the processor 1010, and this remote memory can be connected to the industrial control data flow detection model building apparatus or the industrial control data flow detection apparatus via a network. The input device 1030 can receive calculation requests (or other numerical or character information) input by the user, and generate key signal inputs related to the industrial control data flow detection model building apparatus or the industrial control data flow detection apparatus. The output device 1040 may include a display device such as a screen for outputting the calculation results.

[0113] This invention provides a computer-readable storage medium that stores computer instructions. The computer storage medium stores computer-executable instructions that can execute the industrial control data flow detection model construction method or the industrial control data flow detection method in any of the above method embodiments. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), random access memory (RAM), flash memory, hard disk drive (HDD), or solid-state drive (SSD), etc.; the storage medium may also include combinations of the above types of memory.

[0114] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable storage medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable storage medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of computer-readable storage media include: electrical connections (electronic devices) having one or more wires, portable computer disk drives (magnetic devices), random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), fiber optic devices, and compact disc read-only memory (CDROM). Furthermore, computer-readable storage media can even be paper or other suitable media on which programs can be printed, because programs can be obtained electronically, for example, by optically scanning the paper or other media, followed by editing, interpreting, or otherwise processing as necessary, and then stored in computer memory.

[0115] It should be understood that various parts of this disclosure can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented using software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0116] In the description of this specification, the references to terms such as "this embodiment," "an embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of this disclosure. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples, without contradiction. In the description of this disclosure, "a plurality of" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0117] Obviously, the above embodiments are merely illustrative examples for clear explanation and are not intended to limit the implementation. Those skilled in the art will recognize that other variations or modifications can be made based on the above description. It is neither necessary nor possible to exhaustively list all possible implementations here. However, obvious variations or modifications derived therefrom are still within the scope of protection of this invention.

Claims

1. A method for constructing an industrial control data flow detection model, characterized in that, include: Obtain an industrial control data stream sample set, which includes: normal industrial control data stream samples and abnormal industrial control data stream samples; Each industrial control data stream sample in the industrial control data stream sample set is converted into a binary sequence; The length of the converted binary sequence is normalized. The binary sequence is divided according to a preset byte size, and each byte of data after division is used as a pixel to construct the corresponding grayscale image; wherein, the binary sequence is a normalized binary sequence; The preset deep learning model is trained using each of the constructed grayscale images until the training results meet the preset conditions, thus obtaining the industrial control data flow detection model. The step of constructing a corresponding grayscale image by treating each byte of data after division as a pixel includes: The size of the grayscale image to be constructed is determined based on the length of bytes contained in the normalized binary sequence. The grayscale value of each pixel in the grayscale image to be constructed is determined based on the decimal value corresponding to each byte of data after division. The grayscale image is constructed by arranging the grayscale values ​​of each pixel in a preset order.

2. The method for constructing an industrial control data stream detection model according to claim 1, wherein converting each industrial control data stream sample in the industrial control data stream sample set into a binary sequence and dividing the binary sequence according to byte size and constructing a corresponding grayscale image by treating each byte of data as a pixel, comprises: Convert each preset format data packet in each industrial control data stream into a binary sequence; The binary sequence is divided according to byte size, and each byte of data is treated as a pixel to construct a grayscale image corresponding to each data packet.

3. The method for constructing an industrial control data flow detection model according to claim 1, characterized in that, Before the step of converting each industrial control data stream sample in the industrial control data stream sample set into a binary sequence, the method further includes: The data packets in the industrial control data stream of the obtained industrial control data stream sample set are filtered and preprocessed.

4. The method for constructing an industrial control data flow detection model according to claim 1, characterized in that, The normalization process for the length of the binary byte sequence includes: Obtain the length of bytes contained in the binary sequence; If the length of bytes in the binary sequence is less than the preset length, the insufficient part is padded with zeros; If the length of bytes in the binary sequence is greater than the preset length, a binary sequence of the preset length is extracted from the corresponding binary sequence.

5. A method for detecting industrial control data streams, characterized in that, include: Obtain the grayscale image obtained by converting the industrial control data stream to be detected; The grayscale image is input into the target detection model constructed using the industrial control data flow detection model construction method as described in any one of claims 1-4; The output of the target detection model is used to determine whether the industrial control data stream to be detected is abnormal.

6. A device for constructing an industrial control data flow detection model, characterized in that, include: The first acquisition module is used to acquire an industrial control data stream sample set, which includes: normal industrial control data stream samples and abnormal industrial control data stream samples. A conversion module is used to convert each industrial control data stream sample in the industrial control data stream sample set into a binary sequence; The normalization module is used to normalize the length of the converted binary sequence; A construction module is used to divide the binary sequence according to a preset byte size and construct a corresponding grayscale image by treating each byte of data after division as a pixel; wherein, the binary sequence is a normalized binary sequence; The training module is used to train a preset deep learning model using each of the constructed grayscale images until the training results meet preset conditions, thereby obtaining an industrial control data flow detection model. The building module includes: The first determining unit is used to determine the size of the grayscale image to be constructed based on the length of bytes contained in the normalized binary sequence. The second determining unit is used to determine the grayscale value of each pixel in the grayscale image to be constructed based on the decimal size corresponding to each byte of data after division. An arrangement unit is used to arrange the grayscale values ​​of each pixel in a preset order to construct the grayscale image.

7. An industrial control data stream detection device, characterized in that, include: The second acquisition module is used to acquire a grayscale image converted from the industrial control data stream to be detected; The input module is used to input the grayscale image into the target detection model constructed using the industrial control data flow detection model construction method as described in any one of claims 1-6; The determination module is used to determine whether the industrial control data stream to be detected is abnormal based on the output results of the target detection model.

8. A computer device, characterized in that, It includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; Memory, used to store computer programs; When a processor executes a program stored in a memory, it implements the steps of the industrial control data flow detection model construction method according to any one of claims 1-4, or the steps of the industrial control data flow detection method according to claim 5.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the industrial control data flow detection model construction method as described in any one of claims 1-4, or the steps of the industrial control data flow detection method as described in claim 5.

Images